CCNA 200-301 v2 (200-301) — Questions 1–75

Runts result from collisions on half-duplex links or faulty network interface cards, not from CRC errors.

CSMA/CD is only used in half-duplex environments; full-duplex disables collision detection entirely.

Auto-MDIX does not participate in speed or duplex negotiation; that function is handled by auto-negotiation (IEEE 802.3u).

Incorrect because DELETE does not encrypt payloads; it removes resources from the server. Encryption is handled separately and not by HTTP methods themselves.

Incorrect because PUT does not retrieve lists of resources; it replaces or updates an existing resource. Retrieval is typically done by GET.

Incorrect because while many APIs require tokens for authentication, GET itself does not inherently require a token; authentication depends on API security design, not the HTTP method.

Option A is incorrect because HTTP 200 does not indicate resource deletion. Deletion success is usually represented by 204 No Content or 202 Accepted, not 200.

Option C is incorrect since authentication failures return 401 Unauthorized or 403 Forbidden, not 200. A 200 response confirms successful authentication and request processing.

Option D is incorrect because HTTP 200 does not signal any server reboot requirement. Server maintenance or reboot notifications are not conveyed via standard HTTP success codes.

Incorrect. 10.24.7.191 is the last address of a larger /26 subnet block, not the /27 block containing 10.24.7.158, so it cannot be the broadcast address here.

Incorrect. 10.24.7.127 is the broadcast address of the previous /27 subnet block (10.24.7.96/27), not the one containing 10.24.7.158.

Incorrect. 10.24.7.160 is the network address of the next /27 subnet block after 10.24.7.128/27, not the broadcast address of the current subnet.

The order of ACL entries is crucial; the first match is applied. Here, the permit any any matches all SMTP before the deny can block the specific traffic.

The deny any any matches all SMTP, so the subsequent permit for the specific source/destination is never reached.

The permit ip any any matches all traffic, so the subsequent deny for SMTP is never applied.

Incorrect because the dns-server statement is optional; its absence does not prevent the DHCP server from assigning IP addresses to clients.

Incorrect because the ip helper-address command is only necessary when forwarding DHCP requests across subnets, not when the router itself is the DHCP server on the VLAN.

This option is incorrect because sticky learning does not remove or disable the configured maximum secure MAC address limit; the limit remains enforced regardless of sticky learning.

This option is incorrect because sticky learning does not change the port type or convert it into a trunk; port mode remains unchanged and unrelated to sticky MAC learning.

This option is incorrect because sticky MAC addresses can persist if the configuration is saved, so port security is not disabled after a reboot; sticky learning supports persistence, not disabling.

Option A is incorrect because the RADIUS server does not handle Layer 2 trunk negotiation. Trunking is managed by protocols such as DTP or manual switchport configuration, not by the authentication server.

Option C is incorrect because DHCP is responsible for IP address assignment, not the RADIUS server. RADIUS focuses solely on authentication, authorization, and accounting functions.

Option D is incorrect because the RADIUS server does not generate ARP replies or perform any gateway functions. These tasks are handled by routers or Layer 3 devices in the network.

Native VLAN mismatches can cause traffic to leak between VLANs, but they do not prevent a trunk from becoming operational. The output clearly shows the encapsulation type as ISL, not a native VLAN problem.

Candidates might assume a misconfigured mode causes the issue, but the exhibit confirms the port is in trunk mode ('on' mode).

New learners might equate 'not-trunking' with a shutdown state, but 'admin down' is a distinct status. The port is operationally unable to trunk, not manually disabled.

802.11ac supports only up to 256‑QAM; 1024‑QAM is introduced with 802.11ax.

802.11ac operates only in the 5 GHz band, but 802.11ax operates in both 2.4 GHz and 5 GHz.

Both 802.11ac and 802.11ax support a range of channel widths, including 20, 40, 80, and 160 MHz; neither standard restricts to a single channel width.

The ACL is applied outbound on G0/0 instead of inbound on G0/1. Although it may achieve the goal, it is not the most efficient placement and may not be the expected answer in a PBQ.

Missing the explicit deny statement. The implicit deny at the end of the ACL will block other traffic, but the question expects an explicit deny for clarity and completeness.

The deny statement is too broad; it denies all IP traffic, not just traffic to the loopback. The correct deny should be specific to the loopback host.

Option B is incorrect because the OSPF route to 10.1.1.0/24 is less specific than the /26 static route. Even though OSPF is a dynamic protocol, the router prefers the more specific static route.

Option C is incorrect since the OSPF route to 10.1.0.0/16 covers a much larger network and is less specific than both the /24 and /26 routes, so it is not chosen for 10.1.1.70.

Option D is incorrect because the default route is only used when no other more specific route matches the destination. Here, the /26 static route is more specific, so the default route is ignored.

In restrict mode, the port does not go to err-disabled state; that behavior is specific to shutdown mode. Shutdown mode disables the port upon a violation, whereas restrict mode only drops traffic from unknown MACs and increments the violation counter.

Port security does not automatically learn additional MAC addresses after a delay; it strictly enforces the configured maximum number of MAC addresses. If the maximum is set to 2, any new MAC address beyond that triggers a violation action (restrict, shutdown, or protect) immediately, not after 30 seconds.

STP (Spanning Tree Protocol) is used to prevent loops in redundant topologies and does not enforce port security. Port security violations are handled by the port security feature itself, independent of STP. STP blocking a port would be unrelated to MAC address limits.

Candidates think that seeing the same global port means overload is not operating, but port reuse is normal in extended PAT.

Candidates may misinterpret the summary line as a static identity NAT rule that locks all translations to a single port.

Candidates confuse pool exhaustion (no free global addresses) with port reuse. Exhaustion typically manifests as translation failures, not as many entries sharing the same port.

The subnet mask /24 is too large, causing a mismatch with R2's /30; the default gateway must be R2's IP (203.0.113.2); EUI-64 is not used on G0/0.

The duplicate IPv4 address on G0/1 is not resolved; it still uses 192.168.1.1 which is already assigned to R3.

EUI-64 is required on G0/0, not G0/1; static IPv6 is required on G0/1, not G0/0.

Root Guard is designed to prevent a port from becoming a root port, not to accelerate forwarding. It does not skip the STP listening/learning states, so it cannot provide rapid transition for end-user ports.

Loop Guard is used to prevent alternate or root ports from transitioning to forwarding in the absence of BPDUs, which helps avoid loops. It has no effect on host startup or DHCP acceleration.

OSPFv2 supports only IPv4; OSPFv3 is required for IPv6 routing.

OSPFv3 uses a 32-bit router-id, which must be manually configured or derived from an IPv4 address; without it, the process cannot operate.

Verification commands like 'show ospfv3 neighbor' and 'show ipv6 route ospf' are necessary to ensure OSPFv3 is functioning correctly.

This statement is false because passive-interface does not prevent the network from being advertised; the prefix is still injected into the OSPF LSAs.

Passive-interface only stops OSPF control packets; data traffic forwarding continues normally on the interface.

The passive-interface command does not remove the network from the OSPF routing table; the network is still reachable via other interfaces.

The /26 prefix corresponds to subnet mask 255.255.255.192, which has 64 addresses per subnet, not 32. The mask 255.255.255.224 has 27 network bits, not 26.

The /28 prefix corresponds to subnet mask 255.255.255.240, which provides 16 addresses per subnet (14 usable). The mask 255.255.255.224 has 32 addresses per subnet, so /28 is incorrect.

The /29 prefix corresponds to subnet mask 255.255.255.248, which provides 8 addresses per subnet (6 usable). The mask 255.255.255.224 has 32 addresses, so /29 is incorrect.

Incorrect. Default routes are less preferred than connected or static routes because routers always choose the most specific route first based on longest prefix match.

Incorrect. Default routes can exist alongside dynamic routing protocols and do not require dynamic routing to be disabled; they complement dynamic routes as a last resort.

Incorrect. A default route does not remove the need for route selection logic; routers still evaluate all routes and prefer more specific matches before using the default.

Option B is incorrect because metrics like OSPF cost are only compared among routes from the same protocol; the router does not compare OSPF cost against static route administrative distance.

Option D is incorrect because routes from different sources with different administrative distances do not qualify for equal-cost multipath (ECMP), so both routes are not installed simultaneously.

The interface shows Full Duplex and 1000 Mbps with no collisions or late collisions, which indicates no duplex mismatch. Duplex mismatch typically causes collisions and late collisions, which are absent here.

The transmit power of -3.5 dBm is within the normal range for SX SFP (-1.0 to -9.5 dBm), so the SFP is transmitting correctly. Low transmit power would not cause CRC errors if it is within specifications.

The SX SFP supports up to 550m on OM3 fiber, and the link is operational, so distance is not the issue. Excessive CRC errors due to distance would typically cause the link to be down or unstable.

Incorrect. HTTPS uses TCP, not UDP. Denying UDP port 443 would not block HTTPS traffic, so this option is factually wrong.

Incorrect. It is unnecessary to deny all IP traffic to block HTTPS. Targeting the specific TCP port 443 is sufficient and more secure practice.

Incorrect. ACLs can filter by destination port even when using the host keyword. Both host-based IP matching and port filtering are valid in extended ACLs.

STP root bridge priority is irrelevant here because the network path to the IP address is already functional, meaning Layer 2 switching and spanning-tree topology are stable and not causing the failure.

PPP encapsulation on the WAN edge is not the cause since the symptom is specific to hostname resolution failure, and IP connectivity over the WAN is already confirmed as working.

EtherChannel member consistency issues would affect link aggregation and potentially cause connectivity failures, but since the client can reach the service by IP, EtherChannel problems are not the root cause.

This option incorrectly claims version control increases interface bandwidth, which is unrelated to version control functionality. Bandwidth is a physical and configuration attribute unaffected by file management systems.

This option is incorrect because version control does not replace device backups. Backups protect device states and data beyond just file changes, which version control alone cannot ensure.

This option falsely asserts that version control guarantees error-free configuration changes. While it improves process discipline, it cannot prevent human errors or validate correctness automatically.

In the blocking state, the port does not participate in STP actively; it only receives BPDUs but does not send them or transition toward forwarding. The question specifies a state that listens for BPDUs and participates in STP, which is the listening state, not blocking.

The learning state populates the MAC address table by learning source MAC addresses from incoming frames, which directly contradicts the question's requirement that the state does not learn MAC addresses. Learning occurs after listening and before forwarding.

The forwarding state both learns MAC addresses and forwards traffic, which violates the condition that the state does not learn MAC addresses. Forwarding is the final state where the port is fully operational.

Incorrect because ACLs do not evaluate every line; they stop processing once a match is found, making this statement false.

Incorrect because Cisco ACLs do not end with an implicit permit; the default behavior is an implicit deny for unmatched traffic.

Incorrect because ACLs filter traffic at Layer 3 and Layer 4, not at Layer 1, so this statement is factually wrong.

Skips the more likely and fundamental subnet mask check, which would render timer issues irrelevant until resolved.

Ignores the more foundational IP addressing check that could also cause the issue, and area troubleshooting would be misleading if the subnet mask is incorrect.

Jumps to an OSPF-specific command without first verifying the fundamental IP subnet configuration, which is a more direct cause of failed adjacencies on broadcast links.

Encryption is not the primary reason; CLI can use SSH and APIs are about structured interaction.

Screen-scraping can be automated network-wide; the key differentiator is the interface structure.

Human error is mitigated by automation itself, not a unique advantage of APIs.

Link-local addresses are not routable; they are confined to a single link or network segment. Routers will not forward packets with a link-local source or destination address beyond the local subnet.

While EUI-64 is one method for generating the interface ID, link-local addresses can also use randomly generated identifiers (privacy extensions) or be manually configured. The statement that they always use EUI-64 is incorrect.

The default gateway for IPv6 hosts is typically a global unicast or unique local address, not a link-local address. While routers may send Router Advertisements with a link-local source, the default gateway address learned by hosts is the router's link-local address, but the host uses that link-local address as the next-hop, not as the default gateway address itself. The statement is misleading because the default gateway is often the link-local address of the router, but the host uses it as the next-hop, not as a routable address.

DFS channels are used to avoid radar interference, but the problem described is co-channel interference on channel 36, not radar events. The exhibit shows no radar events, so enabling DFS channels would not address the high channel utilization.

Increasing channel width to 160 MHz would actually increase the likelihood of co-channel interference because fewer non-overlapping channels are available, and it would not solve the existing high utilization on channel 36.

Disabling 2.4 GHz radios would force all clients to 5 GHz, potentially worsening the co-channel interference on channel 36 by adding more clients to an already congested channel. The 2.4 GHz band is not the source of the problem.

Option C is incorrect because JSON is not an encryption protocol; it does not provide any security or protection for API sessions, which are handled by other protocols like TLS.

Option D is incorrect because JSON does not replace authentication; authentication is a separate process that controls access to APIs and network devices.

Option E is incorrect because JSON is a data format, not an API or directional interface like a southbound API, which refers to communication from controllers to devices.

A 401 status code specifically indicates authentication failure, not a missing endpoint. A non-existent endpoint would return a 404 Not Found status code, which is a different HTTP error.

A successful request with an empty body would return a 204 No Content status code, not 401. The 401 code explicitly means the request was not processed due to missing or invalid authentication.

A server overload is indicated by a 503 Service Unavailable status code, not 401. The 401 code is solely related to authentication issues, not server capacity.

UDP is a connectionless protocol that does not use acknowledgments, sequence numbers, or retransmissions; it simply sends datagrams without any guarantee of delivery. Reliable delivery mechanisms like acknowledgments are a feature of TCP, not UDP.

TCP uses port numbers extensively to identify source and destination applications, just like UDP. Port numbers are a fundamental part of both TCP and UDP headers, enabling multiplexing of multiple services on a single host.

While UDP has lower overhead and can be faster in some scenarios, it is not 'always faster' because network congestion, packet loss, and application behavior can affect performance. Additionally, UDP does not inherently avoid congestion; it simply does not implement congestion control, which can lead to network congestion if used aggressively.

Re-authentication forces the phone to re-authenticate, but the port remains in single-host mode, which only allows one authenticated device. The phone's data and voice domains are not separated, so the voice VLAN assignment still fails.

The voice VLAN is already configured with 'switchport voice vlan 10' as stated in the scenario. The issue is not the VLAN definition but the authentication domain separation; the phone remains unauthenticated because the port cannot assign the voice VLAN without proper multi-domain support.

Setting 'authentication port-control force-authorized' bypasses 802.1X authentication entirely, which defeats the purpose of port-based security. It would allow the phone to connect without authentication, but the voice VLAN assignment still requires proper domain handling; moreover, this is not a secure solution.

Root Guard does not cause a port to go into err-disabled state; instead, it places the port into a root-inconsistent state if a superior BPDU is received, blocking traffic but not disabling the port. The question describes an immediate err-disabled state, which is characteristic of BPDU Guard, not Root Guard.

UDLD aggressive mode does not immediately cause an err-disabled state upon connecting a new switch; it detects unidirectional links by sending probes and can put the port into err-disabled state only after a failure is detected, which takes time. The immediate err-disabled state suggests a feature that reacts instantly to BPDUs.

Storm control does not cause a port to go into err-disabled state by default; it typically drops traffic exceeding a threshold or can be configured to shut down the port, but the immediate err-disabled state upon connecting a new switch is not typical for storm control. The scenario points to a feature that reacts to BPDUs, not broadcast storms.

This option is incorrect because Syslog does not assign IP addresses; DHCP is the protocol responsible for IP address allocation in Cisco networks.

This option is incorrect because Syslog does not prevent switching loops; this function is handled by Spanning Tree Protocol (STP).

This option is incorrect because Syslog complements but does not replace broader network monitoring systems that provide additional analysis and alerting capabilities.

Port security restricts access based on MAC addresses, not VLANs, and the event message explicitly mentions BPDU Guard, not port security. The exhibit shows a spanning-tree BPDU Guard error, not a port security violation.

DHCP snooping does not cause err-disabled state due to BPDU reception; it filters DHCP messages and can disable ports for DHCP attacks, but the exhibit clearly shows a spanning-tree BPDU Guard event.

EtherChannel suspension occurs due to configuration mismatches or link failures, not BPDU reception. The exhibit's syslog message explicitly identifies BPDU Guard, not EtherChannel issues.

Incorrect because tokens are usually time-limited and expire after a set period to enhance security, so they are not permanent credentials.

Incorrect because Telnet is unrelated to API token authentication; tokens do not depend on Telnet or any specific legacy protocol.

Incorrect because authentication tokens do not convert data formats; their sole purpose is to authenticate clients, not to transform JSON into XML or any other format.

The 2-WAY state confirms bidirectional communication between OSPF neighbors but does not indicate that the full link-state database has been exchanged. It is an intermediate step before full adjacency.

EXSTART is the initial phase of database exchange where routers negotiate master-slave roles and sequence numbers. It does not mean the databases are fully synchronized yet.

INIT state means a router has received a hello packet from a neighbor but has not confirmed bidirectional communication, so full database exchange has not started.

YANG is a data modeling language, not a data format; it describes the structure of data but does not use key-value pairs for API responses.

Syslog is a protocol for logging system events, not a data format for REST API responses.

CDP is a Cisco proprietary discovery protocol for neighbor devices, irrelevant to data formats in REST APIs.

The ACL does not block all traffic; it only denies TCP traffic destined for port 80 (HTTP). Other traffic, including ICMP, is permitted by the subsequent 'permit ip any any' statement.

Line 20 does not override line 10 because ACLs use first-match logic. Once a packet matches line 10 (TCP port 80), it is denied and no further processing occurs. Line 20 only applies to packets that do not match earlier entries.

ICMP is not explicitly blocked; it is permitted by the 'permit ip any any' statement on line 20, which covers all IP protocols including ICMP. The user's ping works, confirming this.

The source interface must be Loopback0 for consistency, and the trap level should be warnings (4) to include warnings.

The NTP server address must be updated to 198.51.100.1; 192.0.2.1 is the misconfigured server.

The trap level should be warnings (4), not debugging (7). Debugging sends all messages, flooding the server.

This is incorrect because tagged traffic on the trunk is not dropped due to a native VLAN mismatch; tagged frames continue to be forwarded normally if VLANs are allowed on both sides.

This option is wrong since a native VLAN mismatch does not disable Spanning Tree Protocol; STP continues to operate normally on the trunk link.

This is incorrect because Cisco switches do not automatically convert a trunk port to an access port due to a native VLAN mismatch; the trunk remains active.

The error is adding an unnecessary access VLAN command for the AP port, which is not required and could conflict with existing configuration.

The error is using show vlan instead of show interfaces switchport to verify voice VLAN on a port.

The error is using show interfaces trunk, which is for trunk ports, not for verifying voice VLAN on an access port.

Option A incorrectly claims version control automatically fixes coding mistakes. While version control tracks changes, it does not validate or correct errors in scripts, so this option is false.

Option C falsely suggests version control removes the need for API authentication. Authentication is a separate security process and is not affected by version control.

Option D incorrectly claims version control replaces the device operating system. Version control manages script versions only and does not interact with device OS software.

The OSPF /24 route is less specific than the static /25 route. Since longest-prefix match prefers the more specific route, the OSPF route is not used for 192.168.1.200.

Both routes do not automatically load-balance because they have different prefix lengths. Load balancing requires equal prefix length and equal cost routes, which is not the case here.

Neither route is incorrect because overlapping routes are common and resolved by longest-prefix match. The router uses the more specific static /25 route, so traffic is forwarded correctly.

NetFlow is used for traffic monitoring and analysis, while SNMP traps are used for network management notifications. Neither feature affects STP behavior or port state transitions; they do not cause a port to go err-disabled upon receiving a BPDU.

OSPF passive-interface prevents OSPF from sending routing updates on an interface but does not affect STP or port security. EUI-64 is used for IPv6 address generation. Neither feature relates to BPDU handling or err-disable behavior.

WPA3 is a wireless security protocol, and CAPWAP is a control and provisioning protocol for wireless access points. These are entirely unrelated to wired switch port STP behavior and cannot cause a port to go err-disabled due to BPDU reception.

172.31.9.192 is the network address of the subnet, which is reserved and cannot be assigned to any host. In IPv4, the network address is used to identify the subnet itself, not as a host address.

172.31.9.223 is the broadcast address of the subnet, which is reserved for sending traffic to all hosts in the subnet. It cannot be assigned to a host.

172.31.9.201 is a valid host address in the subnet, but it is not the first usable host. The first usable host is .193, which comes after the network address .192.

Removing VLAN 10 from the allowed list would break an already functioning VLAN and would not fix VLAN 30.

Both ISL and 802.1Q support multiple VLANs; the problem is not the trunking protocol but the allowed VLAN list.

Changing a trunk port to access mode would terminate the trunk, preventing all VLAN traffic across the link.

IP subnet masks are Layer 3 concepts and do not affect Layer 2 VLAN propagation across a switchport. The issue here is purely Layer 2, related to the switchport mode (access vs. trunk), not IP addressing. VLANs 20 and 30 would still fail regardless of subnet mask configuration.

Routed ports are Layer 3 interfaces used for routing between networks, not for carrying multiple VLANs. The standard method for carrying multiple VLANs between switches is to use a trunk port, which tags frames with VLAN IDs. A routed port would not solve the issue and would break Layer 2 connectivity.

STP (Spanning Tree Protocol) prevents loops by blocking redundant paths, but it does not selectively block specific VLANs based on their VLAN ID. If STP were blocking VLANs 20 and 30, it would be due to a misconfiguration like PVST+ inconsistencies, not by design. The scenario describes a simple access port misconfiguration, not an STP issue.

PAgP is a Cisco proprietary protocol and cannot negotiate with LACP. Even if one side is set to PAgP desirable, the LACP active side will not respond, resulting in no EtherChannel formation.

The 'on' mode creates a static EtherChannel without any negotiation. Since the LACP active side expects LACP PDUs to form the bundle, the static 'on' side will not send or respond to LACP messages, causing a mismatch.

PAgP auto is a passive PAgP mode that waits for a PAgP desirable partner. It cannot negotiate with LACP active because the protocols are incompatible.

The passive-interface default command would block Hellos, preventing the adjacency from ever reaching the EXSTART/EXCHANGE state.

An OSPF area mismatch would cause Hellos to be ignored, so the adjacency would not progress past the Down or Init state.

Conflicting router IDs would prevent the routers from becoming neighbors at all, as OSPF requires unique router IDs within an area.

This describes a static automation script that runs on a schedule without feedback, but the scenario involves an agent that detects an issue, takes action, re-checks, and escalates if needed, which is adaptive and not static.

Tool-calling is a component of the workflow (executing diagnostic commands and configuration changes), but the overall process includes detection, action, verification, and escalation, which is more than just calling tools.

Reinforcement learning involves continuous trial-and-error learning from rewards, but the scenario uses predefined diagnostics and actions, not learning from past outcomes to improve future decisions.

The specific factual error is that 'no shutdown' only brings an interface out of an administratively down state, but the problem here is a line protocol issue, not an administrative shutdown.

The specific factual error is that the IP address is already configured correctly; the problem is at Layer 2, not Layer 3.

The specific factual error is that keepalive settings are not typically the cause of a line protocol down on modern Ethernet interfaces; duplex mismatch is a more common cause.

Passive mode does not initiate LACP negotiation; it only responds to incoming LACP packets. Active mode is the one that actively sends LACP packets. Therefore, passive mode is not stronger than active mode.

LACP configuration does not change the interface type; it only bundles multiple physical links into a logical EtherChannel. The interface remains a Layer 2 or Layer 3 port based on its configuration, not a routed port automatically.

Passive mode does not cause the switch to delete the port-channel configuration. The configuration remains, but the EtherChannel will not come up because no LACP negotiation occurs.

The specific factual error: Using a /24 mask on a point-to-point link wastes addresses and may cause subnet overlap; also, R2 needs a default route to reach R1's IPv4 address if the mask is /30, but with /24 they are in the same subnet so no default route is needed, but the mask is still wrong.

The specific factual error: R2's IPv4 mask must match R1's mask to ensure both routers agree on the subnet boundary. Using /28 on R2 while R1 uses /30 creates a mismatch.

The specific factual error: Assigning the same IPv6 address to both routers causes a duplicate address conflict, preventing communication.